{"id":"synology-c3rb3r-ransomware-oct-2026","category":"patch","status":"live","title":"Synology NAS devices hit by C3RB3R ransomware through unpatched DSM flaws","tldr":"Ransomware is targeting Synology NAS storage devices running outdated DSM. Update to the latest DSM your model supports, enable automatic updates and keep the management interface off the public internet. Fixes are available.","summary":"Synology NAS owners at home and work face ransomware attacks against outdated DiskStation Manager (DSM), the software running their storage devices. Synology says attackers are exploiting a flaw patched in December 2024, but has not identified its CVE. Its linked advisory covers three flaws involving running code, reading files and writing files. Separately, Qihoo 360 attributes C3RB3R attacks it investigated to two different DSM flaws patched in September 2026. These accounts identify different vulnerabilities; Synology has not reconciled them publicly. Fixes are available for the affected DSM branches listed in both advisories. Owners should install the latest DSM supported by their model rather than rely only on the older minimum fixes.","action":"Update your Synology NAS to the latest DSM supported by its model and enable automatic updates; ask whoever manages it to check the branch-specific fixes below. Remove public internet access to its management interface. Keep an offline backup disconnected from the NAS.","product":"Synology NAS devices running DiskStation Manager (DSM)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2024-10441","CVE-2024-50629","CVE-2024-10445","CVE-2026-13639","CVE-2026-13684"],"tags":["synology","nas","dsm","ransomware","actively-exploited"],"affected":["SA-24:20: DSM 7.2.2 before 7.2.2-72806-1","SA-24:20: DSM 7.2.1 before 7.2.1-69057-6","SA-24:20: DSM 7.2 before 7.2-64570-4","SA-24:20: DSM 7.1 before 7.1.1-42962-7","SA-24:20: DSM 6.2 before 6.2.4-25556-8","SA-26:13: DSM 7.4 before 7.4-90075","SA-26:13: DSM 7.3 before 7.3.2-86009-4","SA-26:13: DSM 7.2.2 before 7.2.2-72806-9","SA-26:13: DSM 7.2.1 before 7.2.1-69057-12"],"fixed":["SA-24:20: DSM 7.2.2-72806-1 or above","SA-24:20: DSM 7.2.1-69057-6 or above","SA-24:20: DSM 7.2-64570-4 or above","SA-24:20: DSM 7.1.1-42962-7 or above","SA-24:20: DSM 6.2.4-25556-8 or above","SA-26:13: DSM 7.4-90075 or above","SA-26:13: DSM 7.3.2-86009-4 or above","SA-26:13: DSM 7.2.2-72806-9 or above","SA-26:13: DSM 7.2.1-69057-12 or above"],"matches":[{"platform":"nas","app":"Synology DSM 7.4","bundle":"","fixed":"7.4-90075"},{"platform":"nas","app":"Synology DSM 7.3","bundle":"","fixed":"7.3.2-86009-4"},{"platform":"nas","app":"Synology DSM 7.2.2","bundle":"","fixed":"7.2.2-72806-9"},{"platform":"nas","app":"Synology DSM 7.2.1","bundle":"","fixed":"7.2.1-69057-12"},{"platform":"nas","app":"Synology DSM 7.2","bundle":"","fixed":"7.2-64570-4"},{"platform":"nas","app":"Synology DSM 7.1","bundle":"","fixed":"7.1.1-42962-7"},{"platform":"nas","app":"Synology DSM 6.2","bundle":"","fixed":"6.2.4-25556-8"}],"sources":[{"kind":"advisory","title":"Synology-SA-24:20 DSM (PWN2OWN 2024)","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_24_20","by":"Synology","date":"2025-03-28"},{"kind":"advisory","title":"Synology-SA-26:13 DSM","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_13","by":"Synology","date":"2026-09-18"},{"kind":"post","title":"Synology urges users to update DSM following ransomware attacks on outdated DSM versions","url":"https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions","by":"Synology","date":"2026-10-29"},{"kind":"research","title":"Cerber ransomware attacks on Synology NAS: incident warning","url":"https://news.safe.360.cn/n/13055.html","by":"Qihoo 360","date":"2026-10-29"},{"kind":"news","title":"Synology warns of C3RB3R ransomware attacks targeting NAS devices","url":"https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/","by":"BleepingComputer","date":"2026-11-03"},{"kind":"news","title":"Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw","url":"https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html","by":"The Hacker News","date":"2026-11-03"}],"started":"2026-10-29","closed":null,"created":"2026-11-03T18:56:19.504Z","updated":"2026-11-03T18:56:19.504Z","cve_notes":[{"cve":"CVE-2024-10441","name":"Remote code execution in Synology DSM's plugin daemon","what":"Incorrect output escaping in DSM's system plugin daemon lets a remote attacker run code.","severity":"critical","cvss":9.8},{"cve":"CVE-2024-50629","name":"File disclosure in Synology DSM's web API","what":"Incorrect output escaping in DSM's web API lets a remote attacker read a limited set of files.","severity":"medium","cvss":5.3},{"cve":"CVE-2024-10445","name":"Certificate validation flaw in Synology DSM updates","what":"Faulty certificate checks in DSM's update function let an attacker intercepting traffic on an adjacent network write a limited set of files.","severity":"medium","cvss":4.3},{"cve":"CVE-2026-13639","name":"Insufficient randomness in Synology DSM login logic","what":"Insufficient randomness in DSM's login logic lets a remote attacker read or change arbitrary files and disrupt service.","severity":"critical","cvss":9.8},{"cve":"CVE-2026-13684","name":"Output escaping flaw in Synology DSM's SCGI component","what":"Incorrect output escaping in DSM's SCGI component lets a remote attacker read or change arbitrary files and disrupt service.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-11-03","added":"2026-11-03T18:54:07.992Z","kind":"other","text":"BleepingComputer updated its report with Synology's response: the company again directed it to SA-24:20 without naming the exploited flaw.","url":"https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-10-29","added":"2026-11-03T18:54:07.992Z","kind":"other","text":"Separately, Qihoo 360 attributed C3RB3R attacks it investigated to CVE-2026-13639 and CVE-2026-13684, patched in September 2026.","url":"https://news.safe.360.cn/n/13055.html","by":"Qihoo 360","patch":null},{"at":"2026-10-29","added":"2026-11-03T18:54:07.992Z","kind":"wider-attacks","text":"Synology warned that attackers were exploiting a flaw patched in December 2024 to encrypt data and demand ransom. It linked SA-24:20 without identifying the exploited CVE.","url":"https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions","by":"Synology","patch":null},{"at":"2026-09-18","added":"2026-11-03T18:54:07.992Z","kind":"new-fix","text":"Synology released fixes for newer DSM flaws, including CVE-2026-13639 and CVE-2026-13684, across DSM 7.4, 7.3, 7.2.2 and 7.2.1.","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_13","by":"Synology","patch":"patched"},{"at":"2024-12-05","added":"2026-11-03T18:54:07.992Z","kind":"new-fix","text":"Synology added DSM 6.2 to advisory SA-24:20 and confirmed its update was available. The advisory now lists fixes for all five affected DSM branches.","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_24_20","by":"Synology","patch":"patched"}],"url":"https://hard.fyi/live/synology-c3rb3r-ransomware-oct-2026/","json":"https://hard.fyi/api/live?id=synology-c3rb3r-ransomware-oct-2026"}